Breaking Adversarial Transferability in Fine-Tuned Speech Recognition

summary

Video file (mp4)

The gist

As an excellent, fastidious, and diligent researcher, I have meticulously analyzed both provided texts regarding the paper "Breaking Adversarial Transferability in Fine-Tuned Speech Recognition." The

In short

TransferBreaker is a framework designed to stop adversarial attacks from transferring from a base speech recognition model to a fine-tuned target model. It uses three methods—Base-AFT, Latent Jacobian Regularization, and HybridGrad-AFT—to create robust defenses. The results show it drastically reduces performance drops under adversarial conditions across multiple languages and models.

Key concepts

Adversarial Transferability
This is the vulnerability where an attack crafted for one speech recognition model can easily be used against a different, fine-tuned model. The paper shows this transfer causes severe performance degradation, meaning security assumptions about limited access are often false.
Base Adversarial Fine-Tuning (Base-AFT)
This technique restricts adversarial training so that perturbations are only trained on those effective for the original base model. This prevents the over-constraining effects seen in standard methods when fine-tuning complex ASR tasks.
Latent Jacobian Regularization (LJ-Regularization)
This mechanism enforces latent-space invariance by actively suppressing directions in the model's internal representation that are highly sensitive to adversarial noise. It neutralizes these specific, vulnerable directions in the model's learned space.

Terminology used across episodes

This episode discusses

The paper

Breaking Adversarial Transferability in Fine-Tuned Speech Recognition · Read on arXiv

Mojtaba Nafez, Aref Mousavi, Mohammad Ebrahim Mahdavi, Mobina Poulaei, Kiarash Kiani Feriz, Mohammad Hossein Rohban

Idiap Research Institute of École Polytechnique Fédérale de Lausanne of Sharif University of Technology and University of Isfahan

Many organizations fine-tune publicly available pretrained Automatic Speech Recognition (ASR) models and deploy them in black-box settings, assuming limited access provides protection. We show this assumption is fragile: adversarial perturbations crafted on the public base model transfer effectively to fine-tuned target models, severely degrading performance and posing concerns for safety-critical applications. We propose TransferBreaker, a unified fine-tuning framework that suppresses adversarial transfer by integrating Base Adversarial Fine-Tuning, which restricts adversarial training to base-effective perturbations; Latent Jacobian Regularization, which enforces latent-space invariance by suppressing adversarially sensitive directions; and HybridGrad-AFT, which improves robustness against adaptive attacks by interpolating transferable perturbations from base and target gradients. We theoretically justify all components and evaluate TransferBreaker across three languages and four large ASR models, reducing adversarial WER from 92.6 to 27.8. Our code is publicly available at https://github.com/rohban-lab/TransferBreaker.

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Today's paper: "Breaking Adversarial Transferability in Fine-Tuned Speech Recognition".

Jane: As an excellent, fastidious, and diligent researcher,

Tom: First, who's behind it and why it matters.

Paper summary: Tom: To wrap up "Breaking Adversarial Transferability in Fine-Tuned Speech Recognition," the authors show that adversarial transferability is a real threat when deploying ASR models fine-tuned on public bases >

Jane: The authors propose TransferBreaker, which uses Base-AFT, Latent Jacobian Regularization, and HybridGrad-AFT to defend against this by combining different techniques into one unified framework >

Lu: It establishes that white-box access to a base model can lead to performance degradation from sixteen point four up to ninety-two point six Word Error Rate on the target model > <ref:2610.09109#pg1>

Meng: For those of us shipping models, it means we have a new layer of defense we need to consider when choosing our deployment strategy >

Lalam: This work confirms that adversarial transferability is a paramount security consideration in the deployment pipeline for publicly available ASR models >

Conclusion: Tom: So we’ve been deep into TransferBreaker, and now we need to talk about what this whole paper is actually trying to prove with that title, "Breaking Adversarial Transferability in Fine-Tuned Speech Recognition."

Jane: Basically, it's saying that when you take a speech recognition model that someone has already fine-tuned on a public base model—like Whisper—you can make little changes to the base and those changes jump over to your target model, messing up its performance badly.

Lu: That’s the core vulnerability they are exposing. The authors show how this happens, quantifying it with a big gap in Word Error Rate, moving from sixteen point four up to ninety-two point six under attack conditions.

Meng: It sounds like a problem for anyone shipping models where you don't control the entire training pipeline; if a base model is public, that vulnerability is real.

Lalam: I’m seeing this as a major security consideration because it means an attacker doesn't need to train on your specific target model directly to cause damage; they can use knowledge from the public base and transfer it.

Tom: Exactly. The authors are proposing TransferBreaker, which uses three specific training tweaks—Base-AFT, Latent Jacobian Regularization, and HybridGrad-AFT—to stop that transfer from happening.

Jane: They aren't just patching things up; they’re showing how to build a unified defense framework that handles the static attacks and the adaptive ones at the same time. It’s about making sure those latent directions in the model stay stable even when you introduce noise.

Lu: The methodology is pretty solid because they have a theoretical justification for each part, like connecting Latent Jacobian sensitivity back to how much noise actually matters in the representation space.

Meng: From an engineering standpoint, I’m looking at how much computational overhead those three components add to the fine-tuning job compared to just doing standard adversarial training. That’s where my concern lies for real deployment scenarios.

Lalam: The authors did look at that cost trade-off in the appendix, comparing it against Standard Adversarial Fine-Tuning, showing a measurable difference in training time and resources used.

Tom: It’s a significant result because they show that this isn't just an academic curiosity; it’s a concrete failure mode when deploying these models publicly. This paper really forces everyone in the ASR space to rethink their deployment security protocols.

Jane: Right, and if we can stop these transfers, we start building more trustworthy systems for things like in-vehicle voice interfaces where those errors could be serious.

Lu: The paper lays out a path forward for model developers who are relying on open or semi-open models to make sure their final product is actually robust against these kinds of attacks.

Meng: So the implication is that if you’re deploying something public, you have to bake in this kind of multi-layered defense into your fine-tuning process before you even consider putting it into production. That’s a pretty heavy lift for production pipelines.

Lalam: It confirms that adversarial transferability isn't just a theoretical risk; it's a practical security flaw we have to address right now across the entire ASR deployment pipeline.

More episodes

← Home